Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using this to rate limit and it works fine:

/usr/sbin/iptables -A INPUT -p tcp --dport 80 -m recent --rcheck --seconds 60 --hitcount 2 --name WWW -j LOG --log-prefix "WWW "

/usr/sbin/iptables -A INPUT -p tcp --dport 80 -m recent --update --seconds 60 --hitcount 2 --name WWW -j DROP

/usr/sbin/iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --set --name WWW -j ACCEPT

The question is, I want to do the same, but the webserver is in another host. I'm natting all the traffic on port 80 to another server, lets say 192.168.1.20. How do I set the limit in the forward/nat/masquerade/whatever it's called?

share|improve this question
add comment

1 Answer

In your iptables rules, to redirect / masquerade to another IP address, you will use the NAT table, the PREROUTING chain and then the REDIRECT action. For example:

iptables -t nat -A PREROUTING -i eth0 [or whatever you're using as an interface] -p tcp --dport 80 -j REDIRECT --to-destination [ip-address]

Add the timing and hitcount rules that you desire.

share|improve this answer
    
im not asking how to redirect traffic, i already do that, im asking how to rate limit the redirections to 2 per minute or something... –  kcinick Apr 21 '12 at 20:37
    
@kcinick Put the check in your FORWARD chain (including the new destination address on the rules), instead. –  Shane Madden Apr 21 '12 at 21:15
    
@ShaneMadden thanks, that work but there is a problem, it limit all the connections as if they come from the same ip, so if i connect 2 time the port is droped for everyone else, is there a workaround for this? –  kcinick Apr 21 '12 at 21:42
    
I figured it out, i have to use the mangle table. –  kcinick Apr 21 '12 at 22:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.